CVE-2026-129131: Gameyfin before 2.6.2 Missing Authorization in Hilla Endpoints
Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as GameEndpoint.sync, which LiveSubscriptionSecurity never checks, to retrieve game catalog metadata, libraries, platforms, plugins and game requests.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Gameyfin installations running a version before 2.6.2 are affected when login-required mode is enabled. The vulnerable Hilla endpoints can still be called without authentication because endpoints annotated with @AnonymousAllowed bypass the intended access control.
What does an attacker need to exploit it?
An attacker needs network access to the Gameyfin service and does not need credentials or user interaction. They can send POST requests to synchronous endpoint methods, including GameEndpoint.sync.
What information could be exposed?
The issue can expose game catalog metadata, libraries, platforms, plugins, and game requests. The provided information indicates confidentiality impact only; it does not describe modification or service-disruption impact.
How can I determine whether an instance is affected?
Check whether the deployed Gameyfin version is earlier than 2.6.2. On such versions, test whether an unauthenticated POST request can invoke synchronous Hilla endpoint methods such as GameEndpoint.sync and return catalog-related data despite login-required mode.